Model checking fault tolerant systems